A person exercising a search power in respect of any data held in a computer system or other data storage device may require a specified person to provide access information and other information or assistance that is reasonable and necessary to allow the person exercising the search power to access that data.
Effectively, if the police search is otherwise legal, then they can compel you to unlock your phone. If you don’t, you can get up to 3 months in prison:
178 Offence of failing to carry out obligations in relation to computer system search
Every person commits an offence and is liable on conviction to imprisonment for a term not exceeding 3 months who fails, without reasonable excuse, to assist a person exercising a search power when requested to do so under section 130(1).
A specified person may not be required under subsection (1) to give any information tending to incriminate the person.
But clarifies in 130 (3):
Subsection (2) does not prevent a person exercising a search power from requiring a specified person to provide information or providing assistance that is reasonable and necessary to allow the person exercising the search power to access data held in, or accessible from, a computer system or other data storage device that contains or may contain information tending to incriminate the specified person.
So basically, if the data used to unlock your phone can incriminate you, you don’t have to provide it. But that doesn’t protect you from incriminating evidence on your phone.
So I guess the moral of the story is that if you’re a drug dealer, make sure your phone password is “ImADrugDealer” and then you can’t be forced to provide that information. But I guess they can force you to unlock it without telling them the password? so I’m not sure what section 130 (2) had in mind.